Advisory
On 08.10.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Enterprise Project Connection.
SAP Note 3523541 addresses "[CVE-2022-23302] Multiple vulnerabilities in SAP Enterprise Project Connection" to prevent denial of service (dos) server-side request forgery (ssrf) deserialization of untrusted data with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Risk specification
This note concerns multiple CVEs in libraries that are used in SAP Enterprise Project Connection: - In Spring Framework applications that parse ETags from "If-Match" or "If-None-Match" request headers allow an authenticated attacker to provide a specially crafted Spring Expression Language (SpEL) expression, resulting in Denial of service (DoS). - Applications using UriComponentsBuilder in the Spring Framework to parse externally provided URLs, such as through query parameters, and validate the host of the parsed URL, may allow an authenticated attacker to exploit open redirect or SSRF vulnerabilities. - JMSSink in all versions of Log4j 1.x allows an authenticated attacker to exploit deserialization of untrusted data if the Log4j configuration can be changed by the attacker or the configuration references an LDAP service under the attacker's control, resulting in remote code execution.Solution
The vulnerable dependencies, Spring Framework and reload4j, were updated. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Update in progress".
The advisory is valid for
- ENTERPRISE_PROJECT_CONNECTION 3.0
